weaver-e10-builder 1.7.0 → 1.7.2

package/dist/commands/form-permission.js

@@ -2,9 +2,9 @@ import { readFileSync } from 'node:fs';
 import { AuthSession } from '../core/auth.js';
 import { ApiClient } from '../core/client.js';
 import { resolveFormId } from '../services/form-id.js';
-import { ARCHIVE_ORG_TYPES, ARCHIVE_TARGETS, ARCHIVE_TARGET_ALIASES, FIELD_ORG_TYPE_LABELS, archiveFileRightsIncludeView, archiveRightsIncludeView, archiveRowKey, buildArchiveRow, buildMatrixValueRelation, ebFormValueFields, matrixValueFields, normalizeArchiveRow, parseArchiveFileRights, parseArchiveRights, resolveFieldOrgType, verifyArchiveRow, } from '../services/form-permission-archive.js';
-import { MATRIX_COND_FUNC_HINT, buildMatrixConditionData, ebFormCondColumns, matrixCondColumns, parseMatrixConditionArgs, pickCondFields, } from '../services/matrix-condition.js';
-import { PERMISSION_CODE_TYPES, PERMISSION_ORG_TYPES, PERMISSION_TARGETS, PERMISSION_TARGET_ALIASES, addPermissionRow, applyPermissionSettings, buildPermissionRow, buildSyncPermissionList, findRightRow, matrixValueCandidates, parseOnOff, parsePermissionFileRights, parsePermissionRights, permissionRightLabels, normalizeFileRightType, readPermissionDetail, resolvePermissionEbForm, resolvePermissionField, resolvePermissionMatrix, targetOfCodeType, updatePermissionDetail, verifyAddedRow, } from '../services/form-permission-edit.js';
+import { ARCHIVE_ORG_TYPES, ARCHIVE_TARGETS, ARCHIVE_TARGET_ALIASES, FIELD_ORG_TYPE_LABELS, archiveFileRightsIncludeView, archiveRightsIncludeView, archiveRowKey, buildArchiveRow, buildMatrixValueRelation, ebFormValueFields, matrixValueFields, normalizeArchiveRow, parseArchiveFileRights, parseArchiveRights, resolveFieldOrgType, sameMatrixRelation, verifyArchiveRow, } from '../services/form-permission-archive.js';
+import { MATRIX_COND_FUNC_HINT, buildMatrixConditionData, canonicalMatrixCondition, ebFormCondColumns, matrixCondColumns, parseMatrixConditionArgs, pickCondFields, summarizeMatrixCondition, } from '../services/matrix-condition.js';
+import { PERMISSION_CODE_TYPES, PERMISSION_ORG_TYPES, PERMISSION_TARGETS, PERMISSION_TARGET_ALIASES, addPermissionRow, applyPermissionSettings, buildImpExpPermissionRow, buildPermissionRow, buildSyncPermissionList, copyImpExpPreservedFields, IMP_EXP_CODE_TYPES, impExpMatrixMismatches, impExpPreservedMismatches, findRightRow, matrixValueCandidates, parseOnOff, parsePermissionFileRights, parsePermissionRights, permissionRightLabels, normalizeFileRightType, readPermissionDetail, resolvePermissionEbForm, resolvePermissionField, resolvePermissionMatrix, targetOfCodeType, updatePermissionDetail, verifyAddedRow, } from '../services/form-permission-edit.js';
 import { fetchFields } from './form-list-utils.js';
 /**
  * Form permission management.
@@ -51,7 +51,7 @@ const RIGHT_TYPES = {
     '9': '数据导入',
     '93': '删除导入数据',
 };
-// 导入导出权限（codeType=data_imp_exp，独立分类——不在共享 dataRightList 里）：
+// 导入导出权限（通用对象 codeType=data_imp_exp、矩阵相关 data_imp_exp_matrix，独立分类——不在共享 dataRightList 里）：
 // rightType 8=导出、9=导入(追加)、93=删除导入数据；93 必须与 9 同选（只勾"删除导入数据"平台语义为更新导入的一部分）。
 // importType "0,1"：0=追加导入、1=更新导入（勾 93 时须带 1）。
 const IMP_EXP_RIGHT_ALIASES = {
@@ -174,6 +174,50 @@ function requireOrgId(orgType, orgId) {
         throw new Error(`--org-type ${orgType} 需要 --org-id（组织对象的 ID）`);
     return id;
 }
+/** 导入导出权限的授权对象类别：通用对象 / 矩阵相关（平台 codeType 分别是 data_imp_exp / data_imp_exp_matrix）。 */
+function resolveImpExpTarget(raw) {
+    const explicit = raw.target === undefined ? '' : String(raw.target).trim().toLowerCase();
+    if (explicit) {
+        if (['general', 'common', '通用', '通用对象'].includes(explicit))
+            return 'general';
+        if (['matrix', '矩阵', '矩阵相关'].includes(explicit))
+            return 'matrix';
+        throw new Error(`不支持的 --target: ${raw.target}，可选: general（通用对象）/ matrix（矩阵相关）`);
+    }
+    if (raw.matrix !== undefined || raw.ebForm !== undefined
+        || raw.matrixValue?.length || raw.matrixValueRaw !== undefined || raw.matrixConditionRaw !== undefined) {
+        return 'matrix';
+    }
+    if (raw.orgType !== undefined || raw.orgId !== undefined || raw.orgName !== undefined)
+        return 'general';
+    return null;
+}
+function addImpExpTargetOptions(cmd) {
+    return cmd
+        .option('--target <type>', '授权对象类别: general 通用对象（默认）/ matrix 矩阵相关')
+        .option('--matrix <idOrName>', '矩阵相关：矩阵 id 或名称')
+        .option('--eb-form <idOrName>', '矩阵相关：e-Builder 表单 id 或名称')
+        .option('--matrix-value <spec...>', '矩阵相关：取值字段（名称或 id:名称:valueType）')
+        .option('--matrix-value-raw <json>', '矩阵相关：取值字段原始 JSON 数组')
+        .option('--matrix-condition-raw <json>', '矩阵相关：条件树原始 JSON');
+}
+function summarizeMatrixValueRelation(raw) {
+    if (raw === undefined || raw === null || String(raw).trim() === '')
+        return '';
+    try {
+        const list = JSON.parse(String(raw));
+        if (!Array.isArray(list))
+            return '';
+        return list.map((item) => String(item?.valueName ?? '')).filter(Boolean).join('、');
+    }
+    catch {
+        return '';
+    }
+}
+function isMatrixPermissionRow(row) {
+    return String(row?.codeType ?? '') === 'data_imp_exp_matrix'
+        || row?.orgType === 'matrix' || row?.orgType === 'ebuilder_form';
+}
 export function registerFormPermissionCommands(form, program) {
     const permCmd = form.command('permission').description('表单权限管理（增删查）');
     // ─── LIST ───────────────────────────────────────────────
@@ -223,6 +267,77 @@ export function registerFormPermissionCommands(form, program) {
     });
     // ─── ADD ────────────────────────────────────────────────
     const dataCmd = permCmd.command('data').description('表单数据权限（共享权限：通用对象 / 创建人 / 字段 / 矩阵 / 政务单位）');
+    /**
+     * 解析「矩阵相关」授权对象。数据权限与导入导出权限共用同一套矩阵字段。
+     *
+     * `current` 用于 update：只改权限项、没给矩阵相关选项时沿用当前矩阵来源与条件；
+     * 换了来源且没点名取值字段时，按新来源的默认字段重建映射（与数据权限一致）。
+     */
+    async function resolveMatrixSubject(client, baseUrl, appId, raw, current) {
+        let source;
+        if (raw.ebForm || raw.matrix) {
+            const useEbForm = Boolean(raw.ebForm);
+            const spec = String(raw.ebForm ?? raw.matrix ?? '');
+            source = useEbForm
+                ? await resolvePermissionEbForm(client, baseUrl, appId, spec)
+                : await resolvePermissionMatrix(client, baseUrl, appId, spec);
+        }
+        else if (current && (current.orgType === 'matrix' || current.orgType === 'ebuilder_form')) {
+            source = {
+                id: String(current.orgId ?? ''),
+                name: String(current.orgName ?? ''),
+                codeType: current.orgType,
+                orgTypeName: String(current.orgTypeName ?? ''),
+            };
+        }
+        else {
+            throw new Error('矩阵权限需要 --matrix（真矩阵）或 --eb-form（e-Builder 表单）');
+        }
+        const sourceChanged = !current
+            || String(source.codeType) !== String(current.orgType ?? '')
+            || String(source.id) !== String(current.orgId ?? '');
+        let matrixValueRelation;
+        if (raw.matrixValueRaw !== undefined) {
+            const parsed = jsonArg(String(raw.matrixValueRaw), '--matrix-value-raw');
+            if (!Array.isArray(parsed) || !parsed.length)
+                throw new Error('--matrix-value-raw 需是非空 JSON 数组');
+            matrixValueRelation = buildMatrixValueRelation(parsed.map((v) => ({
+                valueId: String(v?.valueId ?? ''), valueName: String(v?.valueName ?? ''), valueType: String(v?.valueType ?? ''),
+            })));
+        }
+        else if (raw.matrixValue?.length) {
+            const candidates = await matrixValueCandidates(client, baseUrl, appId, source);
+            matrixValueRelation = buildMatrixValueRelation(raw.matrixValue.map((token) => parseMatrixValueToken(token, candidates)));
+        }
+        else if (!sourceChanged && current?.matrixValueRelation) {
+            matrixValueRelation = String(current.matrixValueRelation);
+        }
+        else {
+            const candidates = await matrixValueCandidates(client, baseUrl, appId, source);
+            const fallback = source.codeType === 'ebuilder_form'
+                ? (candidates.find((c) => c.valueType === 'system_creator') ?? candidates[0])
+                : candidates[0];
+            if (!fallback)
+                throw new Error('该矩阵没有可用取值字段，请用 --matrix-value 或 --matrix-value-raw 明写');
+            matrixValueRelation = buildMatrixValueRelation([fallback]);
+        }
+        let matrixConditionData;
+        if (raw.matrixConditionRaw !== undefined) {
+            const parsed = jsonArg(String(raw.matrixConditionRaw), '--matrix-condition-raw');
+            matrixConditionData = typeof parsed === 'string' ? parsed : JSON.stringify(parsed);
+        }
+        else {
+            matrixConditionData = String(current?.matrixConditionData ?? '');
+        }
+        return {
+            orgType: source.codeType,
+            orgId: String(source.id),
+            orgName: String(source.name ?? ''),
+            orgTypeName: String(source.orgTypeName ?? ''),
+            matrixValueRelation,
+            matrixConditionData,
+        };
+    }
     /**
      * 解析授权对象，产出写进 permission 的字段补丁。
      *
@@ -291,43 +406,14 @@ export function registerFormPermissionCommands(form, program) {
                 };
             }
             case 'matrix': {
-                const useEbForm = Boolean(raw.ebForm);
-                const spec = String(raw.ebForm ?? raw.matrix ?? '');
-                if (!spec)
-                    throw new Error('--target matrix 需要 --matrix（真矩阵）或 --eb-form（e-Builder 表单）');
-                const source = useEbForm
-                    ? await resolvePermissionEbForm(client, baseUrl, appId, spec)
-                    : await resolvePermissionMatrix(client, baseUrl, appId, spec);
-                let relation;
-                if (raw.matrixValueRaw) {
-                    const parsed = jsonArg(String(raw.matrixValueRaw), '--matrix-value-raw');
-                    if (!Array.isArray(parsed) || !parsed.length)
-                        throw new Error('--matrix-value-raw 需是非空 JSON 数组');
-                    relation = buildMatrixValueRelation(parsed.map((v) => ({
-                        valueId: String(v?.valueId ?? ''), valueName: String(v?.valueName ?? ''), valueType: String(v?.valueType ?? ''),
-                    })));
-                }
-                else {
-                    const candidates = await matrixValueCandidates(client, baseUrl, appId, source);
-                    const fallback = useEbForm
-                        ? (candidates.find((c) => c.valueType === 'system_creator') ?? candidates[0])
-                        : candidates[0];
-                    const tokens = raw.matrixValue?.length ? raw.matrixValue : (fallback ? [fallback.valueName] : []);
-                    if (!tokens.length)
-                        throw new Error('该来源没有可用取值字段，请用 --matrix-value-raw 明写');
-                    relation = buildMatrixValueRelation(tokens.map((t) => parseMatrixValueToken(t, candidates)));
-                }
-                let matrixConditionData = '';
-                if (raw.matrixConditionRaw !== undefined) {
-                    const parsed = jsonArg(String(raw.matrixConditionRaw), '--matrix-condition-raw');
-                    matrixConditionData = typeof parsed === 'string' ? parsed : JSON.stringify(parsed);
-                }
+                const subject = await resolveMatrixSubject(client, baseUrl, appId, raw);
                 return {
                     target,
                     patch: {
-                        codeType: source.codeType, orgType: source.codeType, orgId: source.id,
-                        orgName: source.name, orgTypeName: source.orgTypeName,
-                        matrixValueRelation: relation, matrixConditionData,
+                        codeType: subject.orgType, orgType: subject.orgType, orgId: subject.orgId,
+                        orgName: subject.orgName, orgTypeName: subject.orgTypeName,
+                        matrixValueRelation: subject.matrixValueRelation,
+                        matrixConditionData: subject.matrixConditionData,
                     },
                 };
             }
@@ -679,9 +765,10 @@ export function registerFormPermissionCommands(form, program) {
             process.exitCode = 1;
         }
     });
-    // ─── IMP-EXP（导入导出权限，独立分类 data_imp_exp）─────────
+    // ─── IMP-EXP（导入导出权限，独立分类 data_imp_exp / data_imp_exp_matrix）─────────
     // 用户反馈：想加导入导出权限却加到了共享里。共享(dataRightList/obj_data_admin)只有 查看/编辑/删除 三种，
-    // 导入导出是独立分类（impRightList/data_imp_exp），rightType: 8导出/9导入(追加)/93删除导入数据。
+    // 导入导出是独立分类（impRightList），通用对象 data_imp_exp、矩阵相关 data_imp_exp_matrix，
+    // rightType: 8导出/9导入(追加)/93删除导入数据。
     const impCmd = permCmd.command('imp-exp').description('导入导出权限（独立分类，勿用 data add——共享权限只有 查看/编辑/删除）');
     async function readImpRights(client, baseUrl, appId, objId) {
         const listed = await client.get(`${baseUrl}/api/bs/ebuilder/form/permission/getRightList?objId=${objId}&apid=${appId}&belongId=${objId}&type=imp`, { ebbusinessid: appId });
@@ -712,7 +799,8 @@ export function registerFormPermissionCommands(form, program) {
                 return;
             }
             for (const r of items) {
-                console.log(`[${r.id}] ${r.orgName || r.orgTypeName}(${r.orgType})  ${r.rightTypeName || rightTypeLabel(r.rightType)}`);
+                const matrix = isMatrixPermissionRow(r);
+                console.log(`[${r.id}] ${r.orgName || r.orgTypeName}(${r.orgType})  ${r.rightTypeName || rightTypeLabel(r.rightType)}${matrix ? '  [矩阵相关]' : ''}`);
                 const extras = [];
                 if (r.importType)
                     extras.push(`importType=${r.importType}`);
@@ -722,6 +810,12 @@ export function registerFormPermissionCommands(form, program) {
                     extras.push('导出明细');
                 if (r.exportAttachment)
                     extras.push('导出附件');
+                const values = summarizeMatrixValueRelation(r.matrixValueRelation);
+                if (values)
+                    extras.push(`取值字段=${values}`);
+                const conditions = summarizeMatrixCondition(r.matrixConditionData);
+                if (conditions)
+                    extras.push(`条件=${conditions}`);
                 if (extras.length)
                     console.log(`    ${extras.join('  ')}`);
             }
@@ -732,47 +826,81 @@ export function registerFormPermissionCommands(form, program) {
             process.exitCode = 1;
         }
     });
-    impCmd.command('add')
+    addImpExpTargetOptions(impCmd.command('add')
         .description('添加导入导出权限并回读（rightType: export=8 / import=9 / delete-import=93，93 须与 9 同选）')
         .argument('<objId>', '表单 objId')
         .argument('<appId>', '应用 ID')
-        .requiredOption('--org-type <type>', `授权对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-type <type>', `通用对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
         .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
-        .option('--org-name <name>', '授权对象名称（缺省用类型名）', '')
+        .option('--org-name <name>', '授权对象名称（缺省用类型名）')
         .requiredOption('--rights <rights...>', '权限组合: export / import / delete-import（或 8/9/93）')
         .option('--update-import', '允许更新导入（importType 加 1；默认仅追加导入 importType=0）')
         .option('--export-details', '导出明细数据（明细表）')
         .option('--export-attachment', '导出附件')
         .option('--export-field-range <range>', '导出字段范围: listShowField 列表显示字段 / allField 全部字段', 'listShowField')
-        .option('--creator-related <level>', '权限关系: 0 本人 / 1 上级 / 5 本岗位', '0')
-        .action(async (objId, appId, cmdOpts) => {
+        .option('--creator-related <level>', '权限关系: 0 本人 / 1 上级 / 5 本岗位', '0')).action(async (objId, appId, cmdOpts) => {
         try {
             const opts = program.opts();
             const auth = await AuthSession.fromOptions(opts);
             if (!auth)
                 throw new Error('无法加载认证');
-            if (!PERMISSION_ORG_TYPES[cmdOpts.orgType])
-                throw new Error(`不支持的 --org-type: ${cmdOpts.orgType}`);
-            const orgId = requireOrgId(cmdOpts.orgType, cmdOpts.orgId);
-            const orgName = cmdOpts.orgName || PERMISSION_ORG_TYPES[cmdOpts.orgType];
+            const client = new ApiClient(auth);
+            const baseUrl = auth.getBaseUrl();
+            const target = resolveImpExpTarget(cmdOpts) ?? 'general';
+            let orgType;
+            let orgId;
+            let orgName;
+            let orgTypeName;
+            let matrixSubject;
+            if (target === 'matrix') {
+                if (cmdOpts.orgType !== undefined || cmdOpts.orgId !== undefined
+                    || (cmdOpts.orgName !== undefined && cmdOpts.orgName !== '')) {
+                    throw new Error('矩阵相关权限不能用 --org-type / --org-id / --org-name，请用 --matrix 或 --eb-form');
+                }
+                matrixSubject = await resolveMatrixSubject(client, baseUrl, appId, cmdOpts);
+                orgType = matrixSubject.orgType;
+                orgId = matrixSubject.orgId;
+                orgName = matrixSubject.orgName;
+                orgTypeName = matrixSubject.orgTypeName;
+            }
+            else {
+                if (cmdOpts.matrix !== undefined || cmdOpts.ebForm !== undefined
+                    || cmdOpts.matrixValue?.length || cmdOpts.matrixValueRaw !== undefined || cmdOpts.matrixConditionRaw !== undefined) {
+                    throw new Error('通用对象权限不能用矩阵选项，请去掉 --matrix / --eb-form / --matrix-value 等，或加 --target matrix');
+                }
+                if (!cmdOpts.orgType)
+                    throw new Error('通用对象导入导出权限需要 --org-type');
+                if (!PERMISSION_ORG_TYPES[cmdOpts.orgType])
+                    throw new Error(`不支持的 --org-type: ${cmdOpts.orgType}`);
+                orgType = cmdOpts.orgType;
+                orgId = requireOrgId(orgType, cmdOpts.orgId);
+                orgName = cmdOpts.orgName || PERMISSION_ORG_TYPES[orgType];
+                orgTypeName = PERMISSION_ORG_TYPES[orgType];
+            }
             const rightType = parseRightValues(cmdOpts.rights, IMP_EXP_RIGHT_ALIASES, '导入导出权限');
             if (rightType.includes('93') && !rightType.includes('9')) {
                 throw new Error('delete-import(93) 必须与 import(9) 同选（删除导入数据依附于导入）');
             }
             // importType: 0=追加导入（默认）；勾 93（删除导入数据）平台语义含更新导入 → importType 须带 1（抓包：8,9,93 → "0,1"）
             const importType = rightType.includes('93') || cmdOpts.updateImport ? '0,1' : '0';
-            const client = new ApiClient(auth);
-            const baseUrl = auth.getBaseUrl();
-            const perm = {
-                belong: 'obj', belongId: objId, codeType: 'data_imp_exp',
+            const perm = buildImpExpPermissionRow({
+                objId,
+                target,
+                orgType,
+                orgId,
+                orgName,
+                orgTypeName,
+                rightType,
+                importType,
                 exportDetails: cmdOpts.exportDetails ? 1 : 0,
                 exportFieldRange: normalizeExportFieldRange(cmdOpts.exportFieldRange),
-                layoutOrder: 0, orgType: cmdOpts.orgType, creatorRelated: cmdOpts.creatorRelated,
-                orgId, orgVirtualType: '', orgTypeName: PERMISSION_ORG_TYPES[cmdOpts.orgType],
-                rightType, importType, excludeObj: '', isPcMobileSameLayout: '0',
-                orgName, conditionData: '',
-                ...(cmdOpts.exportAttachment ? { exportAttachment: true } : {}),
-            };
+                exportAttachment: Boolean(cmdOpts.exportAttachment),
+                creatorRelated: cmdOpts.creatorRelated,
+                ...(matrixSubject ? {
+                    matrixValueRelation: matrixSubject.matrixValueRelation,
+                    matrixConditionData: matrixSubject.matrixConditionData,
+                } : {}),
+            });
             const added = await client.post(`${baseUrl}/api/bs/ebuilder/form/permission/addRight?objId=${objId}&apid=${appId}&tpaid=${objId}`, [perm], { ebbusinessid: appId });
             if (added?.code !== 200 || !added?.status)
                 throw new Error(added?.msg || '添加失败');
@@ -784,17 +912,38 @@ export function registerFormPermissionCommands(form, program) {
             const saved = items.find((item) => String(item.id) === id);
             if (!saved || String(saved.rightType) !== rightType)
                 throw new Error('导入导出权限保存后回读不一致');
-            if (String(saved.orgType) !== String(cmdOpts.orgType)) {
+            if (String(saved.codeType ?? '') !== perm.codeType) {
+                throw new Error(`导入导出权限保存后回读不一致（codeType 期望 ${perm.codeType}，回读 ${saved.codeType ?? ''}）`);
+            }
+            if (String(saved.orgType) !== String(orgType)) {
                 throw new Error('导入导出权限保存后回读不一致（授权对象类型被平台改写）');
             }
-            if (!['all', 'externalAll'].includes(cmdOpts.orgType) && String(saved.orgId ?? '') !== String(orgId)) {
+            if (!['all', 'externalAll'].includes(orgType) && String(saved.orgId ?? '') !== String(orgId)) {
                 throw new Error('导入导出权限保存后回读不一致（授权对象 ID 被平台改写）');
             }
+            if (matrixSubject) {
+                const matrixMismatch = impExpMatrixMismatches(saved, {
+                    codeType: perm.codeType,
+                    matrixValueRelation: matrixSubject.matrixValueRelation,
+                    matrixConditionData: matrixSubject.matrixConditionData,
+                });
+                if (matrixMismatch.length) {
+                    throw new Error(`导入导出权限保存后回读不一致 —— ${matrixMismatch.join('；')}`);
+                }
+            }
             const label = rightTypeLabel(rightType);
-            if (opts.json)
-                console.log(JSON.stringify({ success: true, id, orgName, orgType: cmdOpts.orgType, orgId, rightType, label, importType }, null, 2));
-            else
-                console.log(`导入导出权限已添加: [${id}] ${orgName} ${label}${importType === '0,1' ? '（含更新导入）' : ''}`);
+            if (opts.json) {
+                console.log(JSON.stringify({
+                    success: true, id, orgName, orgType, orgId, rightType, label, importType,
+                    target, ...(matrixSubject ? { matrixValueRelation: matrixSubject.matrixValueRelation, matrixConditionData: matrixSubject.matrixConditionData } : {}),
+                }, null, 2));
+            }
+            else {
+                console.log(`导入导出权限已添加: [${id}] ${orgName || orgTypeName} ${label}${importType === '0,1' ? '（含更新导入）' : ''}`);
+                const values = matrixSubject ? summarizeMatrixValueRelation(matrixSubject.matrixValueRelation) : '';
+                if (values)
+                    console.log(`  取值字段=${values}`);
+            }
             if (added?.data?.[0]?.isShowRebuild === 2) {
                 console.error(`  注意: 该权限需要重构，执行: e10-cli form permission rebuild ${objId} ${appId} ${id}`);
             }
@@ -804,12 +953,12 @@ export function registerFormPermissionCommands(form, program) {
             process.exitCode = 1;
         }
     });
-    impCmd.command('update')
+    addImpExpTargetOptions(impCmd.command('update')
         .description('修改导入导出权限（整行回写，只改点名项）')
         .argument('<objId>', '表单 objId')
         .argument('<appId>', '应用 ID')
         .requiredOption('--right-id <id>', '权限 ID（form permission imp-exp list 里的 [id]）')
-        .option('--org-type <type>', `授权对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-type <type>', `通用对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
         .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
         .option('--org-name <name>', '授权对象名称')
         .option('--rights <rights...>', '权限组合: export / import / delete-import（或 8/9/93）')
@@ -817,8 +966,7 @@ export function registerFormPermissionCommands(form, program) {
         .option('--export-details <on|off>', '导出明细数据（明细表）')
         .option('--export-attachment <on|off>', '导出附件')
         .option('--export-field-range <range>', '导出字段范围: listShowField 列表显示字段 / allField 全部字段')
-        .option('--creator-related <level>', '权限关系: 0 本人 / 1 上级 / 5 本岗位')
-        .action(async (objId, appId, raw) => {
+        .option('--creator-related <level>', '权限关系: 0 本人 / 1 上级 / 5 本岗位')).action(async (objId, appId, raw) => {
         try {
             const opts = program.opts();
             const auth = await AuthSession.fromOptions(opts);
@@ -831,11 +979,13 @@ export function registerFormPermissionCommands(form, program) {
                 .find((r) => String(r.id) === rightId);
             if (!current)
                 throw new Error(`导入导出权限 ${rightId} 不存在`);
+            const currentMatrix = isMatrixPermissionRow(current);
+            const target = resolveImpExpTarget(raw) ?? (currentMatrix ? 'matrix' : 'general');
             const permission = {
                 id: rightId,
                 belong: current.belong || 'obj',
                 belongId: current.belongId || objId,
-                codeType: 'data_imp_exp',
+                codeType: current.codeType || (currentMatrix ? IMP_EXP_CODE_TYPES.matrix : IMP_EXP_CODE_TYPES.general),
                 orgType: current.orgType,
                 orgId: current.orgId ?? '',
                 orgName: current.orgName ?? '',
@@ -851,21 +1001,67 @@ export function registerFormPermissionCommands(form, program) {
                 orgVirtualType: current.orgVirtualType ?? '',
                 excludeObj: current.excludeObj ?? '',
                 conditionData: current.conditionData ?? '',
+                ...(currentMatrix ? {
+                    matrixValueRelation: current.matrixValueRelation ?? '',
+                    matrixConditionData: current.matrixConditionData ?? '',
+                } : {}),
             };
+            // 这几个字段没有 CLI 选项，但后端 update SQL 是无条件覆盖的；
+            // 不原样带回会把界面上配好的权限描述/导入布局清空。
+            copyImpExpPreservedFields(permission, current);
             const changed = [];
-            if (raw.orgType !== undefined) {
-                const orgType = String(raw.orgType);
-                if (!PERMISSION_ORG_TYPES[orgType]) {
-                    throw new Error(`不支持的 --org-type: ${orgType}，可选: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`);
+            const matrixOptionsGiven = raw.matrix !== undefined || raw.ebForm !== undefined
+                || raw.matrixValue?.length || raw.matrixValueRaw !== undefined || raw.matrixConditionRaw !== undefined;
+            if (target === 'matrix') {
+                if (raw.orgType !== undefined || raw.orgId !== undefined || raw.orgName !== undefined) {
+                    throw new Error('矩阵相关权限不能用 --org-type / --org-id / --org-name，请用 --matrix 或 --eb-form');
+                }
+                if (!currentMatrix || matrixOptionsGiven) {
+                    const subject = await resolveMatrixSubject(client, baseUrl, appId, raw, currentMatrix ? current : undefined);
+                    permission.codeType = IMP_EXP_CODE_TYPES.matrix;
+                    permission.orgType = subject.orgType;
+                    permission.orgId = subject.orgId;
+                    permission.orgName = subject.orgName;
+                    permission.orgTypeName = subject.orgTypeName;
+                    permission.matrixValueRelation = subject.matrixValueRelation;
+                    permission.matrixConditionData = subject.matrixConditionData;
+                    changed.push('codeType', 'orgType', 'orgId', 'matrixValueRelation', 'matrixConditionData');
                 }
-                permission.orgType = orgType;
-                permission.orgId = requireOrgId(orgType, raw.orgId);
-                permission.orgName = raw.orgName || PERMISSION_ORG_TYPES[orgType];
-                permission.orgTypeName = PERMISSION_ORG_TYPES[orgType];
-                changed.push('orgType', 'orgId');
             }
-            else if (raw.orgId !== undefined) {
-                throw new Error('改授权对象需要同时给 --org-type（判断对象种类）');
+            else {
+                if (matrixOptionsGiven) {
+                    throw new Error('通用对象权限不能用矩阵选项，请去掉 --matrix / --eb-form / --matrix-value 等，或加 --target matrix');
+                }
+                if (currentMatrix) {
+                    if (!raw.orgType)
+                        throw new Error('从矩阵相关切换为通用对象需要 --org-type');
+                    const orgType = String(raw.orgType);
+                    if (!PERMISSION_ORG_TYPES[orgType]) {
+                        throw new Error(`不支持的 --org-type: ${orgType}，可选: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`);
+                    }
+                    permission.codeType = IMP_EXP_CODE_TYPES.general;
+                    permission.orgType = orgType;
+                    permission.orgId = requireOrgId(orgType, raw.orgId);
+                    permission.orgName = raw.orgName || PERMISSION_ORG_TYPES[orgType];
+                    permission.orgTypeName = PERMISSION_ORG_TYPES[orgType];
+                    permission.matrixValueRelation = '';
+                    permission.matrixConditionData = '';
+                    changed.push('codeType', 'orgType', 'orgId', 'matrixValueRelation', 'matrixConditionData');
+                }
+                else if (raw.orgType !== undefined) {
+                    const orgType = String(raw.orgType);
+                    if (!PERMISSION_ORG_TYPES[orgType]) {
+                        throw new Error(`不支持的 --org-type: ${orgType}，可选: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`);
+                    }
+                    permission.orgType = orgType;
+                    permission.orgId = requireOrgId(orgType, raw.orgId);
+                    permission.orgName = raw.orgName || PERMISSION_ORG_TYPES[orgType];
+                    permission.orgTypeName = PERMISSION_ORG_TYPES[orgType];
+                    changed.push('orgType', 'orgId');
+                }
+                else if (raw.orgId !== undefined) {
+                    throw new Error('改授权对象需要同时给 --org-type（判断对象种类）');
+                }
             }
             if (raw.rights?.length) {
                 const rightType = parseRightValues(raw.rights, IMP_EXP_RIGHT_ALIASES, '导入导出权限');
@@ -915,6 +1111,17 @@ export function registerFormPermissionCommands(form, program) {
             const cmp = (key) => {
                 if (['orgName', 'orgTypeName'].includes(key))
                     return;
+                if (key === 'matrixValueRelation') {
+                    if (!sameMatrixRelation(after[key], permission[key]))
+                        mismatch.push('matrixValueRelation: 回读与期望不一致');
+                    return;
+                }
+                if (key === 'matrixConditionData') {
+                    if (canonicalMatrixCondition(after[key]) !== canonicalMatrixCondition(permission[key])) {
+                        mismatch.push('matrixConditionData: 回读与期望不一致（条件被平台改写或吞掉了）');
+                    }
+                    return;
+                }
                 if (String(after[key] ?? '') !== String(permission[key] ?? '')) {
                     mismatch.push(`${key}: 期望 ${permission[key] ?? ''}，回读 ${after[key] ?? ''}`);
                 }
@@ -924,14 +1131,27 @@ export function registerFormPermissionCommands(form, program) {
                     continue;
                 cmp(key);
             }
+            mismatch.push(...impExpPreservedMismatches(after, current));
             if (mismatch.length)
                 throw new Error(`导入导出权限保存后回读不一致 —— ${mismatch.join('；')}`);
             const label = rightTypeLabel(String(permission.rightType));
             if (opts.json) {
-                console.log(JSON.stringify({ success: true, id: rightId, orgType: permission.orgType, orgId: permission.orgId, rightType: permission.rightType, label, importType: permission.importType }, null, 2));
+                console.log(JSON.stringify({
+                    success: true, id: rightId, orgType: permission.orgType, orgId: permission.orgId,
+                    rightType: permission.rightType, label, importType: permission.importType, target,
+                    ...(target === 'matrix' ? {
+                        matrixValueRelation: permission.matrixValueRelation,
+                        matrixConditionData: permission.matrixConditionData,
+                    } : {}),
+                }, null, 2));
             }
             else {
                 console.log(`导入导出权限已修改: [${rightId}] ${permission.orgName || permission.orgTypeName} ${label}${permission.importType === '0,1' ? '（含更新导入）' : ''}`);
+                if (target === 'matrix') {
+                    const values = summarizeMatrixValueRelation(permission.matrixValueRelation);
+                    if (values)
+                        console.log(`  取值字段=${values}`);
+                }
             }
         }
         catch (error) {
@@ -958,7 +1178,7 @@ export function registerFormPermissionCommands(form, program) {
                 console.log(JSON.stringify(row, null, 2));
                 return;
             }
-            console.log(`[${row.id}] ${row.orgName || row.orgTypeName}(${row.orgType}/${row.orgId ?? ''})  ${row.rightTypeName || rightTypeLabel(row.rightType)}`);
+            console.log(`[${row.id}] ${row.orgName || row.orgTypeName}(${row.orgType}/${row.orgId ?? ''})  ${row.rightTypeName || rightTypeLabel(row.rightType)}${isMatrixPermissionRow(row) ? '  [矩阵相关]' : ''}`);
             if (row.importType)
                 console.log(`  importType=${row.importType}`);
             if (row.exportFieldRange)
@@ -967,6 +1187,12 @@ export function registerFormPermissionCommands(form, program) {
                 console.log('  导出明细');
             if (row.exportAttachment)
                 console.log('  导出附件');
+            const values = summarizeMatrixValueRelation(row.matrixValueRelation);
+            if (values)
+                console.log(`  取值字段=${values}`);
+            const conditions = summarizeMatrixCondition(row.matrixConditionData);
+            if (conditions)
+                console.log(`  条件=${conditions}`);
         }
         catch (error) {
             console.error(`读取导入导出权限失败: ${error.message}`);